Skip to main content

​
Overview

Instance HA operates with elevated compute privileges — it can initiate instance evacuations, modify host states, and access IPMI credentials stored in the database. Proper security configuration limits the blast radius of a compromised service account, prevents unauthorized recovery triggers, and protects sensitive infrastructure credentials.
Incorrectly configured RBAC policies may allow project users to trigger instance evacuations across other projects. Review the default policy rules before production deployment.

​
RBAC Policy Enforcement

Instance HA enforces role-based access control via the Oslo policy engine. Default roles:
RolePermissions
adminFull access — create/modify/delete segments, approve and trigger recovery
memberRead access to notifications and segment listings
readerRead-only access to all Instance HA resources

​
Review Default Policies

List effective policies
docker exec masakari_api \
  oslopolicy-list-redundant --config-file /etc/masakari/masakari.conf

​
Restrict Segment Management

To restrict segment creation and deletion to cloud administrators only, verify the default policy rules are not overridden in your deployment:
Check policy overrides
cat /etc/xavs/instance-ha/policy.yaml
If the file does not exist or is empty, the built-in defaults apply. The built-in defaults correctly restrict destructive operations to the admin role.

​
Service Account Credentials

Instance HA authenticates to Xloud Identity and the Compute API using a dedicated masakari service account. Manage these credentials securely.

Rotate service account password

Generate a new password

Generate secure password
openssl rand -base64 32

Update the Identity service

Update service account password
openstack user set --password <new-password> masakari

Update the configuration file

Edit configuration
vi /etc/xavs/instance-ha/instance-ha.conf
Update the [keystone_authtoken] section:
[keystone_authtoken]
password = <new-password>

Restart the service

Restart Instance HA containers
docker restart masakari_api masakari_engine masakari_hostmonitor
Service restarts without authentication errors in logs.
The masakari service account requires the following minimum roles:
ServiceRolePurpose
Xloud ComputeadminInitiate evacuations, query host state
Xloud IdentityserviceAuthenticate API tokens
Do not grant broader roles than required. The admin role on Compute is necessary for evacuation operations and cannot be reduced.

​
IPMI Credential Security

IPMI credentials are stored in the Instance HA database within the hosts.control_attributes column. These credentials grant physical access to compute hardware.

Database access restriction

Limit database access to the Instance HA service account only:
Grant minimum database privileges
GRANT SELECT, INSERT, UPDATE, DELETE ON masakari.* TO 'masakari'@'%';
REVOKE ALL ON masakari.* FROM 'root'@'%';
Verify no other service accounts have access to the masakari database.
Debug logging may write control_attributes contents (including IPMI passwords) to log files. Ensure debug logging is disabled:
/etc/xavs/instance-ha/instance-ha.conf
[DEFAULT]
debug = False
Verify debug is disabled
grep -i debug /etc/xavs/instance-ha/instance-ha.conf
Enabling debug = True in production exposes IPMI credentials in log output. Never enable debug logging on production controllers without log file access controls.
For the highest security posture, manage IPMI credentials using Xloud Key Management (Barbican) and inject them into Instance HA via a custom notification driver that fetches credentials at runtime rather than storing them in the database.This requires a custom control_attributes resolver plugin — consult the Instance HA architecture page for the plugin interface documentation.

​
Network Access Controls

IPMI Network Isolation

Place IPMI management interfaces on a dedicated management VLAN. Only the Instance HA controller should have network access to IPMI interfaces (UDP port 623).

API Endpoint Protection

The Instance HA API (port 15868) should only be accessible from trusted management networks. Do not expose it to project tenant networks.

​
Audit Logging

All Instance HA operations are logged with the requesting user’s token identity. Retain API access logs for at least 90 days to support incident investigations.
Check API access logs
docker logs masakari_api | grep -E "POST|DELETE|PUT"
Review recent notification events
openstack notification list --limit 100 -f json

​
Next Steps

Engine Configuration

Tune recovery parameters including debug logging settings.

Troubleshooting

Diagnose authentication failures and policy enforcement issues.

Architecture

Review the full Instance HA deployment topology and trust boundaries.

Notification Drivers

Secure the webhook notification endpoint with appropriate authentication.